I think that warnings refers not just to vulnerabilities in dependencies, but also in potentially malicious code in the add-on itself, which is harder to catch

I think that warnings refers not just to vulnerabilities in dependencies, but also in potentially malicious code in the add-on itself, which is harder to catch with an automated scan. (Note: this is my interpretation as an add-on developer, not as a Mozilla employee - I'm not involved in addons.mozilla.org.)